Ithuneli liphezulu, ayikho i-inthanethi: kulapho ukudlulisa kuma khona

Ukuqinisekisa kanye nethuneli elisebenzayo akusho ukuphuma ku-inthanethi. Landela isicelo esisodwa ngokukhethwa kwekheli lomthombo, ukudlulisa kanye nendlela yempendulo.

Iklayenti liyaxhumana, ithuneli lithwala ama-ping liya esangweni, futhi akukho lutho ngale kwalo oluphendulayo. Leso simo sijwayelekile esangweni ebelihlale lihloselwe kuphela ukunikeza ukufinyelela kumanethiwekhi avikelekile, futhi kuyiphutha esangweni elikhangiswa njengokuphuma kwethuneli eligcwele. Ngaphambi kokushintsha imithetho, qinisekisa ukuthi yiluphi usizo olwathenjiswa. Bese ulandela isicelo esisodwa somphakathi ezindaweni ezine lapho singama khona. Isicelo esisodwa nokubanjwa kwephakethe kukodwa kuxazulula okungaphezu kwekhasi lokucabanga.

Qinisekisa ukuthi ukuphuma ku-inthanethi kwakuwumklamo ngempela

Iphrofayela yethuneli ehlukanisiwe iqondisa kuphela amanethiwekhi amancane avikelekile ku-VPN, ngakho ukuphequlula komphakathi kuqhubeka ngoxhumano lwendawo futhi akukaze kuthinte isango. Iphrofayela yethuneli eligcwele ifaka indlela ezenzakalelayo ethunelini, okwenza isango libe nesibopho sendlela yonke. Womabili imiklamo esemthethweni, futhi ukuwahlanganisa kukhiqiza umbiko wephutha lapho kungekho khona. Funda izindlela ezimenywe yiklayenti ngaphambi kokuhlola noma yini enye, ngoba ithebula lezindlela liphendula umbuzo okungathi iphuzu lihlale liwubeka kabi.

Lokho iklayenti elikufakayo akuhlali kuyikho okuhloswe yiphrofayela. Indlela ephushiwe ingahlulwa yindlela yendawo enesilinganiso esiphansi, futhi iklayenti eligcina indlela yalo ye-LAN ngenkathi lengeza indlela ezenzakalelayo liziphatha njengethuneli elihlukanisiwe kuleyo nethiwekhi encane.

Landela isicelo esisodwa somphakathi

Khetha indawo eyodwa bese uyilandela isuka eklayenti iya ngaphandle. Eklayentini, hlola ukuthi iphakethe likhetha ithuneli ngempela nokuthi yiliphi ikheli lendawo elilisebenzisa njengomthombo. Bese uhlola isango: ingabe iphakethe liyafika, futhi ingabe liphuma kusixhumi esibonakalayo somphakathi. Ngayinye yalezi zimpendulo isusa isigaba esiphelele sesizathu.

ip route get 1.1.1.1
ip -4 addr show tun0
conntrack -L | grep 1.1.1.1
tcpdump -ni any host 1.1.1.1

Uma isango lingakaze libone iphakethe, indlela yeklayenti noma ukukhetha kwethuneli akulungile. Uma lifika futhi lingaphumi, inkinga isesangweni, futhi kusebenza izivivinyo ezintathu ezisele.

Hlola ukudlulisa, indlela nokuhumusha

Umhlahlandlela wokudlulisa ohamba ne-strongSwan usebenza esangweni lanoma yiluphi uhlobo lwethuneli: umgogodla kufanele uvunyelwe ukuhambisa amaphakethe phakathi kwezixhumi, futhi indlela esebenzisekayo kufanele ikhombe ku-inthanethi. Khona-ke inqubomgomo yodonga lomlilo kufanele ivume ukugcwala, futhi ikheli lomthombo kufanele libe yilelo uhlangothi lomphakathi olungayiphendula. Ikheli leklayenti eliyimfihlo elidluliswa lingashintshwanga liya ku-inthanethi alitholi mpendulo neze.

sysctl net.ipv4.ip_forward
ip route get 1.1.1.1
nft list ruleset | grep -A6 forward
sysctl net.ipv4.conf.all.rp_filter

Ukuhumusha komthombo yingxenye evamile elahlekile. Ngakho isango libhala kabusha umthombo weklayenti likhombise ikheli lalo lomphakathi futhi lilandele ukugeleza; ngaphandle kwalo impendulo ayinandawo yokuya. Izinkundla zamafu zengeza umngcele wesibili, lapho ithebula lezindlela noma iqembu lokuphepha lesikhungo kungase kulahle uphiko olugcwala oluvunyelwa udonga lomlilo lwesivakashi. Lowo mngcele kulula ukuwushiya ngoba uhlelo lwesivakashi lubonakala luhlelwe kahle ngaphakathi.

Ukuhlunga kwendlela ephindayo ekuhlelweni okungalingani nakho kungase kulahle amaphakethe avumelekile. Funda isibali salowo mthetho esikhundleni sokucabanga ukuthi kulungile, ngoba ukuhlelwa okuqinile kusixhumi esibonakalayo somphakathi kunqaba uphiko olufika ngendlela ehlukile kunaleya ebikezelwa ithebula lezindlela.

Indlela yempendulo nesixazululi ziyizimpendulo ezimbili ezihlukene

Buka nempendulo, hhayi isicelo kuphela. Uma isicelo siphuma sihumushiwe futhi impendulo ibuyela ekugelezweni okuhumushiwe, ukudlulisa kuyasebenza ngisho lapho uhlelo lokusebenza lusahluleka, futhi uphenyo olulandelayo lungolohlelo lokusebenza noma lwe-DNS.

Isizindalwazi esibuyisela iphutha le-HTTP siwubufakazi bokuthi ukudlulisa ku-inthanethi kuyasebenza. Igama elingaxazululeki ngenkathi ukufinyelela ngekheli kusebenza inkinga yesixazululi, hhayi inkinga ye-NAT.

Ngemva kokulungiswa okunembile, hlola futhi iklayenti kanye nanoma yinsiza eyimfihlo evinjelwe ngamabomu. Ukunikeza ukufinyelela ku-inthanethi akumele kwandise buthule ukufinyelela kunoma yiliphi inethiwekhi elixhunywe esangweni.

Izihloko ezihlobene